#securityoperation

[durantbarta]

CIK raids: চার জেলায় একযোগে তল্লাশি, স্লিপার সেলের সন্ধানে সিআইকে

The Counter-Intelligence Kashmir (CIK) of the Jammu and Kashmir Police is conducting searches at 10 locations in four districts of the Valle

[impactng]

Police intensify security operations in FCT

To ensure a hitch free Yuletide in the Federal Capital Territory (FCT), the Police Command has intensified patrol, joint operations and raid of black spots across the territory. The Commissioner of Police (CP), Bala Ciroma disclosed this at a news conference in Abuja. He said the command had redoubled efforts in the deployment of personnel, surveillance and stop and search operations in the territory. Ciroma said the counter kidnapping operations of the command aimed at dislodging kidnappers and their bases was still ongoing. He said the command would not leave any stone upturned until it rid the FCT of crime and criminality, adding that the ban on fireworks/knockouts was still in place. The CP called on the public to ensure proper scrutiny of domestic applicants, drivers, house help and security guards before employment. He said the call was in view of the new trend of crimes committed by domestic employees against employers and family members. Ciroma said that a total of 53 suspects were arrested by the command over various criminal activities in the last one month. He said one suspect, 29, was arrested on Dec. 8 by operatives from the command along Kwali-Rubochi axis over kidnapping. The CP said two suspects, aged 42 years and 34 years, were also arrested on Dec. 9 over attempt to kidnap their employees. Ciroma said four suspects were on Dec. 5 arrested by the anti-kidnapping squad attached to the command over car theft. He said the suspects had confessed to have stolen 54 vehicles within the FCT during investigation. The CP said that 34 fabricated master keys, two network jammers, three sledge hammers, 11 screw drivers, two towing vans and other items were recovered from the suspects. Ciroma said that three suspects were arrested on Oct. 28 by a special anti-robbery squad attached to the command over cultism. He said the suspects had confessed to belong to Arrow Vikings Confraternity during investigation, but added that efforts were being made to arrest the leader of the gang. The CP said that the anti-cultism squad attached to the command had also arrested 13 suspects during an initiation party into Arrow Baga Sarakusa Marine, a secret cult. He said the items recovered from the suspects were two initiation pots, several clothes badged with the cult emblem, initiation beads, red clothes, one large printed banner carrying the cult name and one rubber gun. Ciroma said the suspects would be arraigned in court upon completion of investigation. Read the full article

[dgmpeople]

5 Reasons Why Security Operations Need More Than A SIEM

SIEMs are mandatory tools for forensic security teams, aggregating logs from a multitude of sources, exploring within a dataset, and auditing thoroughly. But anyone who’s tried to run their security operations solely on a SIEM (Security Information and Event Management), knows all too well its limitations:

1. Hard to connect the dots

One of the major challenges when using security monitoring and analytics tools is how to deal with the high number of alerts and false positives. Even when the most straightforward policies are applied, SIEMs end up alerting on far too many incidents that are neither malicious nor urgent. The goal is not to be alerted on every possible incident, but to identify, in real-time, the incidents driven by actual malicious activity. Getting there can be a cumbersome process, requiring detailed investigation and a series of diagnoses. Typical scenarios might include: pinpointing the IP address of the suspicious user activity, identifying the relevant logs and determining, which devices were affected. Only then can a researcher decide if the threat is real. Connecting the dots is indeed cumbersome and time-consuming. During this process the race against the attackers is at risk and a backlog of unhandled incidents is created.

2. Insufficient correlation rules

The out-of-the-box, correlation rules of traditional SIEM solutions are insufficient to address the needs of today’s organizations. They need to be extensively configured to meet the unique requirement of the organization. This a time-consuming task requiring significant technical understanding of the organization’s cybersecurity infrastructure.

Another major challenge lies in the fact that it’s impossible to create rules broad enough to factor every conceivable event. New threats are continually emerging and changing and SIEMs need to be continuously maintained in order to adapt to the evolving landscape. The result is that most SIEMs end up running with limited coverage, particularly around correlation of activities.

3. Challenging user-experience

SIEMs are capable of monitoring logs from a multitude of locations at once, striving to eliminate the risk of missing important events. They receive information from various endpoints by pulling or accepting pushed event data, triggering alerts according to predefined correlation rules. Using SIEM dashboards, SOC teams should be able to view and analyze event information in real-time. However, as the organization’s network expand and data accumulates, security professionals are unable to see the log’s origin, user identities, user activities, and if they could be a potential threat.

SIEMs typically show all network and log activities in a tabular format, making it difficult to quickly get insights from the data. Even if the event data is organized by categories with defined policies, viewing the entire network in one consolidated display is still challenging.

Read More: https://www.siemplify.co/blog/5-reasons-why-security-operations-need-more-than-a-siem/